1 /* 2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* chacha20_poly1305 cipher implementation */ 11 12 #include "internal/endian.h" 13 #include "cipher_chacha20_poly1305.h" 14 15 static int chacha_poly1305_tls_init(PROV_CIPHER_CTX *bctx, 16 unsigned char *aad, size_t alen) 17 { 18 unsigned int len; 19 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 20 21 if (alen != EVP_AEAD_TLS1_AAD_LEN) 22 return 0; 23 24 memcpy(ctx->tls_aad, aad, EVP_AEAD_TLS1_AAD_LEN); 25 len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1]; 26 aad = ctx->tls_aad; 27 if (!bctx->enc) { 28 if (len < POLY1305_BLOCK_SIZE) 29 return 0; 30 len -= POLY1305_BLOCK_SIZE; /* discount attached tag */ 31 aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8); 32 aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len; 33 } 34 ctx->tls_payload_length = len; 35 36 /* merge record sequence number as per RFC7905 */ 37 ctx->chacha.counter[1] = ctx->nonce[0]; 38 ctx->chacha.counter[2] = ctx->nonce[1] ^ CHACHA_U8TOU32(aad); 39 ctx->chacha.counter[3] = ctx->nonce[2] ^ CHACHA_U8TOU32(aad + 4); 40 ctx->mac_inited = 0; 41 42 return POLY1305_BLOCK_SIZE; /* tag length */ 43 } 44 45 static int chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX *bctx, 46 unsigned char *fixed, size_t flen) 47 { 48 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 49 50 if (flen != CHACHA20_POLY1305_IVLEN) 51 return 0; 52 ctx->nonce[0] = ctx->chacha.counter[1] = CHACHA_U8TOU32(fixed); 53 ctx->nonce[1] = ctx->chacha.counter[2] = CHACHA_U8TOU32(fixed + 4); 54 ctx->nonce[2] = ctx->chacha.counter[3] = CHACHA_U8TOU32(fixed + 8); 55 return 1; 56 } 57 58 static int chacha20_poly1305_initkey(PROV_CIPHER_CTX *bctx, 59 const unsigned char *key, size_t keylen) 60 { 61 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 62 63 ctx->len.aad = 0; 64 ctx->len.text = 0; 65 ctx->aad = 0; 66 ctx->mac_inited = 0; 67 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH; 68 69 if (bctx->enc) 70 return ossl_chacha20_einit(&ctx->chacha, key, keylen, NULL, 0, NULL); 71 else 72 return ossl_chacha20_dinit(&ctx->chacha, key, keylen, NULL, 0, NULL); 73 } 74 75 static int chacha20_poly1305_initiv(PROV_CIPHER_CTX *bctx) 76 { 77 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 78 unsigned char tempiv[CHACHA_CTR_SIZE] = { 0 }; 79 int ret = 1; 80 size_t noncelen = CHACHA20_POLY1305_IVLEN; 81 82 ctx->len.aad = 0; 83 ctx->len.text = 0; 84 ctx->aad = 0; 85 ctx->mac_inited = 0; 86 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH; 87 88 /* pad on the left */ 89 memcpy(tempiv + CHACHA_CTR_SIZE - noncelen, bctx->oiv, 90 noncelen); 91 92 if (bctx->enc) 93 ret = ossl_chacha20_einit(&ctx->chacha, NULL, 0, 94 tempiv, sizeof(tempiv), NULL); 95 else 96 ret = ossl_chacha20_dinit(&ctx->chacha, NULL, 0, 97 tempiv, sizeof(tempiv), NULL); 98 ctx->nonce[0] = ctx->chacha.counter[1]; 99 ctx->nonce[1] = ctx->chacha.counter[2]; 100 ctx->nonce[2] = ctx->chacha.counter[3]; 101 bctx->iv_set = 1; 102 return ret; 103 } 104 105 #if !defined(OPENSSL_SMALL_FOOTPRINT) 106 107 #if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)) 108 #define XOR128_HELPERS 109 void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len); 110 void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len); 111 static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 }; 112 #else 113 static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 }; 114 #endif 115 116 static int chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX *bctx, 117 unsigned char *out, 118 size_t *out_padlen, 119 const unsigned char *in, size_t len) 120 { 121 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 122 POLY1305 *poly = &ctx->poly1305; 123 size_t tail, tohash_len, buf_len, plen = ctx->tls_payload_length; 124 unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32]; 125 126 DECLARE_IS_ENDIAN; 127 128 buf = storage + ((0 - (size_t)storage) & 15); /* align */ 129 ctr = buf + CHACHA_BLK_SIZE; 130 tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE; 131 132 #ifdef XOR128_HELPERS 133 if (plen <= 3 * CHACHA_BLK_SIZE) { 134 ctx->chacha.counter[0] = 0; 135 buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE); 136 ChaCha20_ctr32(buf, zero, buf_len, ctx->chacha.key.d, ctx->chacha.counter); 137 Poly1305_Init(poly, buf); 138 ctx->chacha.partial_len = 0; 139 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE); 140 tohash_len = POLY1305_BLOCK_SIZE; 141 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN; 142 ctx->len.text = plen; 143 144 if (plen) { 145 if (bctx->enc) 146 ctr = xor128_encrypt_n_pad(out, in, ctr, plen); 147 else 148 ctr = xor128_decrypt_n_pad(out, in, ctr, plen); 149 150 in += plen; 151 out += plen; 152 tohash_len = (size_t)(ctr - tohash); 153 } 154 } 155 #else 156 if (plen <= CHACHA_BLK_SIZE) { 157 size_t i; 158 159 ctx->chacha.counter[0] = 0; 160 ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE), 161 ctx->chacha.key.d, ctx->chacha.counter); 162 Poly1305_Init(poly, buf); 163 ctx->chacha.partial_len = 0; 164 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE); 165 tohash_len = POLY1305_BLOCK_SIZE; 166 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN; 167 ctx->len.text = plen; 168 169 if (bctx->enc) { 170 for (i = 0; i < plen; i++) 171 out[i] = ctr[i] ^= in[i]; 172 } else { 173 for (i = 0; i < plen; i++) { 174 unsigned char c = in[i]; 175 176 out[i] = ctr[i] ^ c; 177 ctr[i] = c; 178 } 179 } 180 181 in += i; 182 out += i; 183 184 tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1); 185 memset(ctr + i, 0, tail); 186 ctr += i + tail; 187 tohash_len += i + tail; 188 } 189 #endif 190 else { 191 ctx->chacha.counter[0] = 0; 192 ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE), 193 ctx->chacha.key.d, ctx->chacha.counter); 194 Poly1305_Init(poly, buf); 195 ctx->chacha.counter[0] = 1; 196 ctx->chacha.partial_len = 0; 197 Poly1305_Update(poly, ctx->tls_aad, POLY1305_BLOCK_SIZE); 198 tohash = ctr; 199 tohash_len = 0; 200 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN; 201 ctx->len.text = plen; 202 203 if (bctx->enc) { 204 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter); 205 Poly1305_Update(poly, out, plen); 206 } else { 207 Poly1305_Update(poly, in, plen); 208 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter); 209 } 210 211 in += plen; 212 out += plen; 213 tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1); 214 Poly1305_Update(poly, zero, tail); 215 } 216 217 if (IS_LITTLE_ENDIAN) { 218 memcpy(ctr, (unsigned char *)&ctx->len, POLY1305_BLOCK_SIZE); 219 } else { 220 ctr[0] = (unsigned char)(ctx->len.aad); 221 ctr[1] = (unsigned char)(ctx->len.aad >> 8); 222 ctr[2] = (unsigned char)(ctx->len.aad >> 16); 223 ctr[3] = (unsigned char)(ctx->len.aad >> 24); 224 ctr[4] = (unsigned char)(ctx->len.aad >> 32); 225 ctr[5] = (unsigned char)(ctx->len.aad >> 40); 226 ctr[6] = (unsigned char)(ctx->len.aad >> 48); 227 ctr[7] = (unsigned char)(ctx->len.aad >> 56); 228 229 ctr[8] = (unsigned char)(ctx->len.text); 230 ctr[9] = (unsigned char)(ctx->len.text >> 8); 231 ctr[10] = (unsigned char)(ctx->len.text >> 16); 232 ctr[11] = (unsigned char)(ctx->len.text >> 24); 233 ctr[12] = (unsigned char)(ctx->len.text >> 32); 234 ctr[13] = (unsigned char)(ctx->len.text >> 40); 235 ctr[14] = (unsigned char)(ctx->len.text >> 48); 236 ctr[15] = (unsigned char)(ctx->len.text >> 56); 237 } 238 tohash_len += POLY1305_BLOCK_SIZE; 239 240 Poly1305_Update(poly, tohash, tohash_len); 241 OPENSSL_cleanse(buf, buf_len); 242 Poly1305_Final(poly, bctx->enc ? ctx->tag : tohash); 243 244 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH; 245 246 if (bctx->enc) { 247 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE); 248 } else { 249 if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) { 250 if (len > POLY1305_BLOCK_SIZE) 251 memset(out - (len - POLY1305_BLOCK_SIZE), 0, 252 len - POLY1305_BLOCK_SIZE); 253 return 0; 254 } 255 /* Strip the tag */ 256 len -= POLY1305_BLOCK_SIZE; 257 } 258 259 *out_padlen = len; 260 return 1; 261 } 262 #else 263 static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 }; 264 #endif /* OPENSSL_SMALL_FOOTPRINT */ 265 266 static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx, 267 unsigned char *out, size_t *outl, 268 const unsigned char *in, size_t inl) 269 { 270 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx; 271 POLY1305 *poly = &ctx->poly1305; 272 size_t rem, plen = ctx->tls_payload_length; 273 size_t olen = 0; 274 int rv = 0; 275 276 DECLARE_IS_ENDIAN; 277 278 if (!ctx->mac_inited) { 279 if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL) { 280 if (inl != plen + POLY1305_BLOCK_SIZE) 281 return 0; 282 #if !defined(OPENSSL_SMALL_FOOTPRINT) 283 return chacha20_poly1305_tls_cipher(bctx, out, outl, in, inl); 284 #endif 285 } 286 287 ctx->chacha.counter[0] = 0; 288 ChaCha20_ctr32(ctx->chacha.buf, zero, CHACHA_BLK_SIZE, 289 ctx->chacha.key.d, ctx->chacha.counter); 290 Poly1305_Init(poly, ctx->chacha.buf); 291 ctx->chacha.counter[0] = 1; 292 ctx->chacha.partial_len = 0; 293 ctx->len.aad = ctx->len.text = 0; 294 ctx->mac_inited = 1; 295 if (plen != NO_TLS_PAYLOAD_LENGTH) { 296 Poly1305_Update(poly, ctx->tls_aad, EVP_AEAD_TLS1_AAD_LEN); 297 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN; 298 ctx->aad = 1; 299 } 300 } 301 302 if (in != NULL) { /* aad or text */ 303 if (out == NULL) { /* aad */ 304 Poly1305_Update(poly, in, inl); 305 ctx->len.aad += inl; 306 ctx->aad = 1; 307 goto finish; 308 } else { /* plain- or ciphertext */ 309 if (ctx->aad) { /* wrap up aad */ 310 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE)) 311 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem); 312 ctx->aad = 0; 313 } 314 315 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH; 316 if (plen == NO_TLS_PAYLOAD_LENGTH) 317 plen = inl; 318 else if (inl != plen + POLY1305_BLOCK_SIZE) 319 goto err; 320 321 if (bctx->enc) { /* plaintext */ 322 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen); 323 Poly1305_Update(poly, out, plen); 324 in += plen; 325 out += plen; 326 ctx->len.text += plen; 327 } else { /* ciphertext */ 328 Poly1305_Update(poly, in, plen); 329 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen); 330 in += plen; 331 out += plen; 332 ctx->len.text += plen; 333 } 334 } 335 } 336 /* explicit final, or tls mode */ 337 if (in == NULL || inl != plen) { 338 339 unsigned char temp[POLY1305_BLOCK_SIZE]; 340 341 if (ctx->aad) { /* wrap up aad */ 342 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE)) 343 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem); 344 ctx->aad = 0; 345 } 346 347 if ((rem = (size_t)ctx->len.text % POLY1305_BLOCK_SIZE)) 348 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem); 349 350 if (IS_LITTLE_ENDIAN) { 351 Poly1305_Update(poly, (unsigned char *)&ctx->len, 352 POLY1305_BLOCK_SIZE); 353 } else { 354 temp[0] = (unsigned char)(ctx->len.aad); 355 temp[1] = (unsigned char)(ctx->len.aad >> 8); 356 temp[2] = (unsigned char)(ctx->len.aad >> 16); 357 temp[3] = (unsigned char)(ctx->len.aad >> 24); 358 temp[4] = (unsigned char)(ctx->len.aad >> 32); 359 temp[5] = (unsigned char)(ctx->len.aad >> 40); 360 temp[6] = (unsigned char)(ctx->len.aad >> 48); 361 temp[7] = (unsigned char)(ctx->len.aad >> 56); 362 temp[8] = (unsigned char)(ctx->len.text); 363 temp[9] = (unsigned char)(ctx->len.text >> 8); 364 temp[10] = (unsigned char)(ctx->len.text >> 16); 365 temp[11] = (unsigned char)(ctx->len.text >> 24); 366 temp[12] = (unsigned char)(ctx->len.text >> 32); 367 temp[13] = (unsigned char)(ctx->len.text >> 40); 368 temp[14] = (unsigned char)(ctx->len.text >> 48); 369 temp[15] = (unsigned char)(ctx->len.text >> 56); 370 Poly1305_Update(poly, temp, POLY1305_BLOCK_SIZE); 371 } 372 Poly1305_Final(poly, bctx->enc ? ctx->tag : temp); 373 ctx->mac_inited = 0; 374 375 if (in != NULL && inl != plen) { 376 if (bctx->enc) { 377 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE); 378 } else { 379 if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) { 380 memset(out - plen, 0, plen); 381 goto err; 382 } 383 /* Strip the tag */ 384 inl -= POLY1305_BLOCK_SIZE; 385 } 386 } else if (!bctx->enc) { 387 if (CRYPTO_memcmp(temp, ctx->tag, ctx->tag_len)) 388 goto err; 389 } 390 } 391 finish: 392 olen = inl; 393 rv = 1; 394 err: 395 *outl = olen; 396 return rv; 397 } 398 399 static const PROV_CIPHER_HW_CHACHA20_POLY1305 chacha20poly1305_hw = { 400 { chacha20_poly1305_initkey, NULL }, 401 chacha20_poly1305_aead_cipher, 402 chacha20_poly1305_initiv, 403 chacha_poly1305_tls_init, 404 chacha_poly1305_tls_iv_set_fixed 405 }; 406 407 const PROV_CIPHER_HW *ossl_prov_cipher_hw_chacha20_poly1305(size_t keybits) 408 { 409 return (PROV_CIPHER_HW *)&chacha20poly1305_hw; 410 } 411
Indexes created Sat Feb 28 05:31:39 UTC 2026